The Controversial Draft Medicare ACO Regulations: Analysis, Comments and Recommended Action

Transcription

1 The Controversial Draft Medicare ACO Regulations: Analysis, Comments and Recommended Action June 2, 2011 Boston Brussels Chicago Düsseldorf Houston London Los Angeles Miami Milan Munich New York Orange County Paris Rome Silicon Valley Washington, D.C. Strategic alliance with MWE China Law Offices (Shanghai)

2 SECTION I. SECTION II. BACKGROUND...1 PROVISIONS OF THE PROPOSED RULE...2 A. Eligibility and Governance...2 B. The Start Date for the ACO Agreement...13 C. Assignment of Medicare Fee-For-Serve Beneficiaries...19 D. Quality and Other Reporting Requirements...21 E. Shared Savings Determinations...28 F. Two-Sided Model...33 G. Monitoring and Termination...38 H. Coordination with Other Agencies...42 I. Overlap with Other CMS Shared Savings Initiatives...44

3 Section I. Background Section 3022 of the Patient Protection and Affordable Care Act (ACA) requires the Secretary of Health and Human Services to establish the Medicare Shared Savings Program (MSSP) by January 1, The MSSP is based on the Physician Group Practice Demonstration and further incorporates the shared savings model of potential bonuses for eligible groups of providers that meet annual performance standards of quality health care services within per capita expenditures boundaries demarcated by the Centers for Medicare & Medicaid Services (CMS). Payment for covered services under MSSP would continue to be at Medicare fee-forservice (FFS) rates, with all of the fundamental elements of the Medicare FFS Program to be preserved. 1 On March 31, 2011, CMS issued Proposed Regulations under the ACA (the Proposed Regulations) 2, 3 to implement the MSSP through the formation of Accountable Care Organizations (ACOs). This White Paper summarizes the major portions of the Proposed Regulations, and identifies issues for providers to consider in commenting and contemplating participation in a Medicare-sponsored ACO. CMS is expected to publish a final rule implementing Section 3022 later this year and in time for implementation on January 1, ACOs create incentives for health care providers to work together to treat an individual patient across care settings. The MSSP will reward ACOs that lower growth in health care costs while meeting performance standards on quality of care. Patient and provider participation in an ACO is purely voluntary. 4 Under the Proposed Regulations, an ACO that meets the MSSP s quality performance standards would be eligible to receive a share of the savings it generates below a specific expenditure benchmark that would be set by CMS for each ACO. The Proposed Regulations would also hold certain ACOs accountable for downside risk by requiring ACOs to repay Medicare for a portion of losses (expenditures above its benchmark). To provide an entry point for organizations with varied levels of experience with risk sharing and desire to take on risk, the Proposed Regulations would allow an ACO to choose one of two program tracks. The first track would allow an ACO to operate on a shared savings only track for the first two years, but would then require the ACO to assume the risk for shared losses in the third year. The second track would require an ACO to share in both savings and risk liability for losses beginning in its first and subsequent performance years, in return for a higher share of any savings the ACO generates. CMS s analysis, set forth in the Regulatory Impact Analysis section of the Proposed Regulations (RIA), concludes that there will be quite significant costs borne to providers who form and participate in ACOs. CMS anticipates it will cost an ACO on average $1.7 million to form and fund first-year operating expenditures needed to participate in the MSSP. CMS expects participation in the MSSP to require groups and providers to invest in or improve information technology systems, focus on evidence-based medicine, improve care coordination and quality, and generally refine all processes of caring for their patients. The estimates in CMS s RIA are based heavily on the experience gained from an earlier CMS demonstration program, namely the Physician Group Practice (PGP) Demonstration, in which large, sophisticated physician groups with well-developed infrastructures and financial strength participated (it should be noted that a number of the PGP participants did not recover their investment in the PGP program, and also did not receive any shared savings payments from the PGP program). CMS is estimating that the return on infrastructure and start-up investment, in the form of shared savings bonus payments to ACO participants (estimated to number 75 to 150) will equal a median amount of $800 million in the aggregate over the first three years of the MSSP. At least two groups have challenged CMS s economic and financial estimates. An article in the New England Journal of Medicine concluded that most organizations will lose money in the first 3 years under the ACO model and noted that... an ACO making the mean initial investment of $1.7 million will require the unlikely margin of 20% for the 3-year period envisioned by CMS. 5 A second report, issued by the American Hospital Association (AHA), concluded that the start-up and ongoing operational costs for an ACO will be between $11.6 million [single hospital] and $26.1 million [five hospital system], noting that these amounts should be viewed as a starting point for planning, not as a budget. The AHA study was based on a series of case studies of organizations that have already taken steps to manage the care of a defined population in a manner similar to that of an ACO, and was completed prior to the release of the Proposed Regulations

4 Section II. Provisions of the Proposed Rule A. Eligibility and Governance 1. ELIGIBLE ENTITIES The Proposed Regulations provide that any of the following entities or groups may form an ACO: (a) ACO Professionals in group practice arrangements, (b) networks of individual practices of ACO Professionals, (c) partnerships or joint ventures between hospitals and ACO Professionals, (d) hospitals that employ ACO Professionals, and (e) critical access hospitals (CAHs) that bill under Method II (i.e., CAHs that bill for professional medical services under a reassignment of benefits and are reimbursed at 115 percent of the Medicare Physician Fee Schedule amount, in addition to facility fees). CMS is proposing that Federally Qualified Health Centers (FQHCs) and Rural Health Centers (RHCs), as well as CAHs billing under Method I (which only bill for facility fees), cannot by themselves form ACOs because they do not report data for ACO Professionals upon which beneficiary attribution can be made. CMS has solicited comments regarding (a) the kinds of providers and suppliers that should or should not be included as potential ACO participants, (b) the potential benefits or concerns with including or not including certain provider and supplier types, (c) the administrative measures that would be required to effectively implement and monitor certain partnerships, (d) other approaches to allowing independent providers and suppliers not mentioned in Section 3022 of the ACA to participate in ACOs (such as through an ACO formed by a group of FQHCs and RHCs), and (e) any operational issues associated with its proposal. Other Medicare-enrolled providers and suppliers (including but not limited to FQHCs and RHCs) can participate in ACOs but cannot form them. In a sense, this is a distinction without a difference, because the ACO entity itself will submit an application to CMS to participate in the MSSP on behalf of its constituent ACO participants, including one or more of the five permitted types of participants and possibly many other types of ACO provider/suppliers. If so, each of these other ACO provider/suppliers may in reality have played an integral role in the formation of the ACO. In essence, CMS is requiring an ACO to be composed of primary care physicians practicing through an ACO entity to which beneficiary attribution can be made. Once that element is present, any other Medicare-enrolled providers and suppliers that have their own tax identification number (TIN), as well as non-providers such as health plans and management companies, may also participate in the ACO. 2. LEGAL STRUCTURE AND GOVERNANCE a. Legal Entity CMS has proposed that an ACO may be organized as any type of entity recognized under state law, including a corporation, partnership, limited liability company or foundation, that is capable of (a) receiving and distributing shared savings; (b) repaying shared losses; (c) establishing, reporting and ensuring ACO participant and ACO provider/supplier compliance with program requirements, including the quality performance standards; and (d) performing the other ACO functions identified in the ACA. The ACO must have its own TIN but need not be enrolled in Medicare. The ACO legal entity must be in good standing and duly qualified to transact business in each state in which it conducts operations. Importantly, existing integrated entities that provide primary care services and meet the requirements for an ACO entity as described in the ACA and the regulations would not be required to form a separate legal entity to serve as the ACO. For example, under the Proposed Regulations, a hospital with employed physicians that is organized as a nonprofit corporation under applicable state law may contract directly with CMS to participate in the MSSP as an ACO, assuming that the hospital met the governance and other requirements discussed below. CMS acknowledges the relatively greater difficulty in auditing an entity that serves as more than just an ACO and solicits comments on whether or not such organizations should be required to form a separate legal entity to serve as the ACO. In any event, if the ACO will include ACO participants that are not - 2 -

5 already part of its legal existing structure (e.g., independent physician practices) it must create a distinct legal entity to function as the statutorily required ACO entity. It is not clear whether this means that the existing legal entity can be used only for those ACOs in which all constituent services are contained as divisions of a single corporate entity, or whether providers and suppliers that are under common control but organized as distinct legal entities could use their parent entity (e.g., a health system parent) or one of the existing constituent entities (e.g., the hospital or medical foundation) as the ACO contracting body, without the necessity of forming a new entity. Each ACO would be required to certify to CMS that it is recognized as a legal entity under state law and authorized by applicable states to conduct business. The ACO would be required to furnish evidence in its application to support this certification. Presumably such proof would be in the form of a certificate of good standing issued by the entity s state of incorporation, as well as evidence of registration to transact business as a foreign entity in any other state in which the ACO conducts operations. CMS is soliciting comments regarding other suitable legal structures that it should consider authorizing under the final rule or subsequent rulemaking. CMS has also requested input regarding whether the requirement to establish a separate legal entity for ACOs that include independent ACO participants is too burdensome, and what alternatives exist that will achieve the aim of shared governance and decision-making, and the ability to receive and distribute shared savings. One concern presented by the requirement to establish a new legal entity is that such entities may be subject to certain state law requirements, such as having to obtain a third party administrator, insurance or HMO license, and/or otherwise be regulated as a risk-bearing organization. In states that impose such requirements (such as California, Colorado, Illinois, New Jersey, New York, Ohio and Pennsylvania), it may be beneficial for an ACO that includes an appropriately statelicensed entity to use that licensed entity as the ACO contracting entity, since that entity would already meet these requirements. Recognition of an ACO as exempt under Section 501(c)(3) of the Internal Revenue Code (the Code) would greatly facilitate the ability of a charitable hospital to provide infrastructure funding for an ACO. Unfortunately, IRS Notice provides very little insight on this question. The Internal Revenue Service (IRS) has generally taken the position that physicianhospital organizations (PHOs) were not eligible for exemption because negotiating managed care contracts for the member-physicians furthers their private interests more than incidentally. Notice reiterates this, noting that negotiating with private health insurers on behalf of unrelated parties generally is not a charitable activity, regardless of whether the agreement negotiated involves a program aimed at achieving cost savings in health care delivery. On the other hand, if the IRS does not equate ACOs to PHOs, exemption for ACOs under the community benefit standard under Section 501(c)(3) of the Code may be possible. In a variety of rulings (both precedential and non-precedential) involving various other types of health care entities, the IRS has provided a list of favorable factors relevant to the community benefit analysis, which should be applicable to seeking tax-exempt status. The fact that an ACO contracting entity would not provide health care services does not preclude it from qualifying as a Section 501(c)(3) organization under the community benefit standard. In other words, the direct provision of medical, hospital or nursing care to individuals is not the exclusive means by which an organization can establish that it promotes health for the benefit of the community within the meaning of Section 501(c)(3). In addition, ACO entities organized as nonprofit corporations may conceivably be able to qualify for tax exemption under a lessening the burdens of government rationale. IRS Notice is helpful in this regard, as it does explicitly acknowledge that the MSSP is intended to lessen the burdens of government

6 The choice of corporate form will be affected by a number of factors. For example, if any ACO were to develop valuable intellectual property (e.g., care models, pricing models, software), the ACO owners could incur considerable tax liability upon the dissolution of an ACO that is organized as a subchapter C corporation if there is significant gain in the value of that intellectual property. This would not be the case if the ACO were organized as a partnership or limited liability company that elects pass-through tax treatment. Generally, a pass-through entity that offers liability protection, such as a limited liability company, would be a preferred vehicle for an ACO. However, use of a pass-through entity can complicate retention of earnings, since the owners require distributions of cash to meet their tax obligations. The companion guidance issued by the Internal Revenue Service, Notice , does state that an exempt organization s participation in an ACO that contracts with CMS under the MSSP generally should not result in inurement or excessive private benefit or the recognition of unrelated business income. This removes the concern that structuring an ACO as a pass-through entity could jeopardize a tax-exempt participant s basis for its own exemption under a primary purposes test, as a result of the pass-through ACO entity s activities being attributed to the exempt ACO participant. It is an open question whether an ACO organized as a nonprofit corporation could be recognized as exempt for federal and state income tax purposes. b. Governance The Proposed Regulations contain a series of explicit governance requirements that would be applicable to an ACO. ACO governance-related requirements are based upon the theme of shared governance (with proportionate control) among ACO participants. The governance body may be styled as a board of directors, a board of managers, or any other governing body that provides a means for shared governance and decision-making for all ACO participants, and that has the authority to execute the statutory functions of the ACO. Specifically, the ACO governance body must have and maintain authority sufficient to carry out the key functions of an ACO as identified by the Proposed Regulations. These include the definition of processes to (a) promote evidence-based medicine and patient engagement, (b) report on quality and cost measures, and (c) coordinate care. The Proposed Regulations also address two provisions related to corporate governance: the establishment of (a) a physician-directed quality assurance and process improvement committee responsible for oversight of a quality assurance and improvement program, and (b) a compliance plan. The compliance plan must include the following key elements: (a) a chief compliance officer (not the ACO s legal counsel) who has the authority to report directly to the ACO Board; (b) mechanisms for identifying and directing ACO operational and performance-related compliance programs; (c) a whistleblower -type reporting mechanism; (d) compliance training for the ACO, its participants and its suppliers/providers; and (e) a particularly controversial requirement to report suspected legal violations to an appropriate law enforcement agency. The Proposed Regulations acknowledge that the specific design and structure of an ACO s compliance plan will depend upon the size and business structure of the ACO. Furthermore, an ACO s compliance efforts may use or build upon an existing compliance program. For example, the ACO may want to coordinate its compliance efforts with those of its ACO providers/suppliers; the ACO need not engage in duplicative compliance efforts. 3. LEADERSHIP AND MANAGEMENT The ACO s leadership and management structure must be managed by an executive, officer, manager or general partner whose appointment and removal are subject to the authority of the ACO board, and whose leadership team has experience in influencing or directing ( has demonstrated the ability to influence or direct ) clinical practice to improve efficiency processes and outcomes. Clinical management is to be the responsibility of a full-time senior-level medical director who must be physically present in an established ACO location and who is a board-certified physician licensed in the ACO s state of operation. Board Composition. The ACO board must be composed of the following constituents: (a) the ACO participants or their designated representatives, and (b) one or more disinterested representatives of the Medicare beneficiary community served by the ACO. Board Authority. The board must possess broad responsibility for the administrative, fiduciary and clinical operations of the ACO

7 Board Control. ACO participants must be assigned no less than 75 percent of board control. Each ACO participant is to appoint an appropriate organizational representative to represent it on the ACO board. Control over ACO decisionmaking should be allocated among the ACO participants on a proportionate basis. Special Board Structure Issues. ACO board members are not precluded from serving in a similar or complementary manner with an existing ACO participant. In those situations where the ACO comprises multiple distinct entities (e.g., several separate independent practice associations ), the governing board of the ACO must remain separate and distinct from the boards of those other entitles. A separate governing body must be established for the ACO (except in certain limited circumstances). The ACO application to CMS must include evidence that the ACO board is a separate legal entity. Single Entity Exception. In situations where the ACO is owned by a discrete legal entity that is clinically and financially integrated and has a governing board that itself satisfies the 75 percent representation requirement of the Proposed Regulations, then the ACO governing board may be the same as that entity s board (provided that the entity s board satisfies the other ACO governance requirements of the Proposed Regulations). Conflicts of Interest Policy. The ACO board must adopt a conflicts of interest policy designed to make sure that its board members act in the best interests of the ACO and its Medicare beneficiaries. This policy will require disclosure of the relevant financial interests of board members, and must also include provisions for (a) determining whether a conflict of interest exists, (b) a process to address any conflict that may arise and (c) remedial actions for board members who fail to comply with the conflict policy. The Proposed Regulations seek comments on a number of governance-related provisions, including those relating to (a) patient involvement in ACO governance, (b) the requirement that at least 75 percent control of the ACO board must be vested in ACO participants, (c) whether the appropriate representatives should be held by persons employed by and representing Medicare-enrolled TINs, (d) the scope and content of the ACO board s conflict of interest policy, and (e) whether the proposed governance requirements might actually serve as a disincentive for ACO formation. 4. ACCOUNTABILITY FOR BENEFICIARIES Section 3022(b)(2)(A) of the ACA requires participating ACOs to be willing to become accountable for the quality, cost and overall care of the Medicare fee-for-service beneficiaries assigned to it. For ACOs to meet this requirement, CMS has proposed that an executive from each participating ACO with the authority to bind the ACO (the ACO Executive) be required to certify, to the best of his or her knowledge, information and belief, that the ACO participants are willing to be accountable for, and report to CMS on, the quality, cost and overall care of the beneficiaries assigned to the ACO. Such certification would be included in the ACO application and the ACO s participation agreement. 7 Each ACO would also be required to make information publicly available, in a standard format as determined by CMS, 8 relating to its accountability for quality, cost and overall care of its assigned beneficiaries. This provision could be viewed as relatively benign; presumably it can be assumed that the ACO participants are willing to agree to these requirements or they would not be voluntarily participating in the ACO in the first instance. However, it is of concern that CMS does not indicate whether the ACO Executive can rely on such affirmative conduct in making the certification or to what degree CMS expects an ACO Executive to obtain some unspecified form of written confirmation from the ACO s participants prior to making the certification. At a minimum, the ACO s contracts with participants should include a provision to that effect. As a practical matter, any such required certifications, and the potential personal liability they entail, may have a chilling effect on the willingness of otherwise qualified individuals to serve in that capacity, or may have the effect of requiring ACOs to pay more for their services than would otherwise be required, in order to attract qualified executives

8 5. AGREEMENT REQUIREMENT While Section 3022(b)(2)(B) of the ACA requires participating ACOs to enter into an agreement with the Secretary to participate in the program for not less than a 3-year period..., CMS is proposing a three-year term for all ACO agreements, and is seeking commentary on whether longer agreements should be considered. 9 Once the ACO is approved for participation and ready to submit an agreement, the ACO Executive would be required to certify, to the best of the ACO Executive s knowledge, that the ACO participants agree to the requirements in the agreement. 10 The ACO Executive is required to sign the agreement and submit it to CMS, along with an acknowledgment that the ACO agrees to comply, and that all of its arrangements relating to the ACO (including with ACO suppliers, providers, service agreements, etc.) will comply, with all requirements for participation in the MSSP. 11 The ACO is responsible for providing a copy of the agreement to its ACO participants and ACO providers/suppliers. 12 As described further in the discussion below regarding Monitoring and Termination of ACOs, if an ACO decides it cannot participate for the entire term of the agreement, the ACO is required to provide at least 60 days advance written notice of its intention to terminate its agreement early and the effective date of such early termination. 13 Since all ACOs are now required to participate in the two-sided risk model, at least by the third year of their contract, CMS is proposing to withhold 25 percent of shared savings to protect Medicare against any future losses. CMS is proposing that, if an ACO completes its threeyear agreement successfully, CMS will refund any such shared savings withhold to the extent not needed to offset the ACO s losses. If, however, the ACO terminates its agreement early, the ACO would forfeit all withheld amounts in order to offset any future losses. 14 Providers and suppliers gearing up for the arrival of ACOs generally are investing in accountable care for the long term. It is unclear whether anything significant can be read into CMS s proposed three-year flat term for ACOs at this time, but certainly ACO participants should press for more long-term commitments, given the substantial efforts being undertaken to form ACOs. Much like the concept of Business Associates under HIPAA, CMS is proposing to require that ACOs require compliance with the MSSP requirements not only by ACO participants but also by downstream contractors. 6. DISTRIBUTION OF SAVINGS CMS is proposing to make any shared savings payments directly to the ACO, as identified by its TIN. At this time, CMS is not requiring that the TIN associated with the ACO s legal entity be enrolled in the Medicare program, although the ACO s participants would be required to be Medicare-enrolled. While this creates a potential obstacle for recoupment of overpayments, CMS is seeking to mitigate such risk through the payment withhold discussed below. CMS proposes to require ACOs to provide a description in their application of the criteria they plan to employ for distributing shared savings among ACO participants and ACO providers/suppliers, and how any shared savings will be used in a manner consistent with the principal aims of the ACO program: better care for individuals, better health for populations and lower growth in expenditures. 15 ACOs are to include this description in the application, so that CMS can ensure that there are no improper financial incentives, and that appropriate beneficiary protections are present. At the outset, it may be difficult to determine how shared savings should be distributed in a manner that ensures both the financial viability of the ACO and the active participation of its participants. Will the ACO be bound by its submitted plan during the initial contract year (or the entire three-year term), or will there be flexibility to adapt and change as the ACO s experience with the MSSP and among its own participants evolves? Where an ACO itself is not enrolled in Medicare, to the extent there is liability or monies owed back to Medicare based on downside risk, the government is likely to try to pierce the ACO and look to its Medicare-enrolled participants to pay the financial obligations of the ACO. This may well have a chilling effect on the willingness of providers to participate in the ACO, particularly in the full two-sided risk model

9 7. SUFFICIENT NUMBER OF PRIMARY CARE PROVIDERS AND BENEFICIARIES Section 3022(b)(2)(D) of the ACA requires participating ACOs to include primary care ACO professionals that are sufficient for the number of Medicare fee-for-service beneficiaries assigned to the ACO... and that at a minimum, the ACO shall have at least 5,000 such beneficiaries assigned to it.... CMS is proposing to assign beneficiaries to an ACO on the basis of primary care services rendered by physicians with primary care specializations in general practice, internal medicine, family practice and geriatrics. CMS is proposing that an algorithm also be used to assign beneficiaries during the baseline years in order to establish a historical per capita cost benchmark against which the ACO would be evaluated during each year of the agreement. CMS believes that if the ACO demonstrates a sufficient number of beneficiaries to fulfill this eligibility requirement for purposes of establishing a benchmark, then the ACO would automatically have a sufficient number of primary care professionals to provide care to these beneficiaries. CMS also believes it is reasonable to assume that the ACO would continue to approximate this number of beneficiaries in each year of the agreement period. Thus, an ACO would be determined to have a sufficient number of primary care ACO professionals to serve the number of Medicare beneficiaries assigned to it if the number of beneficiaries historically assigned to primary care providers within the ACO over the three-year benchmarking period, using the ACO participant TINs, exceeds the 5,000 threshold for each year. The 5,000 minimum beneficiary threshold is deemed by the ACA and CMS to be the critical mass from both the perspective of the capacity of the ACO to provide primary care services to its assigned beneficiary population and the ability of the ACO to realize shared savings by exceeding the Minimum Savings Rate (MSR). However, CMS acknowledges that the number of beneficiaries assigned to an ACO will vary over time, and is seeking to balance the statutory minimum requirement while not unduly punishing or discouraging ACO participation, particularly among smaller ACOs. To balance these concerns, CMS is proposing that, if an ACO s assigned population falls below 5,000 during the course of its agreement, CMS would issue a warning and place the ACO on a corrective action plan, which may include, for example, a plan to attract additional primary care physicians. The ACO would remain eligible to receive shared savings for the performance year for which the warning was issued. However, if the ACO fails to have more than 5,000 beneficiaries by the completion of the next performance year, the ACO s agreement will be terminated, and the ACO will not be eligible to share in savings that year. CMS also proposes to reserve the right to review the status of the ACO while it is subject to the corrective action plan and to terminate the agreement on the basis that the ACO no longer meets eligibility requirements. The issue of beneficiary assignment and the lack of ability of an ACO to lock in or even financially incentivize beneficiaries to stay within the ACO provider network for their care, and thus exercise effective control over the beneficiaries for whom the ACO will be held accountable, represents a fundamental concern and challenge for ACOs. Snowbirds will create particular problems in this regard. For ACOs that are not as large or that do not have significant physician practices committed to the ACO (or its other participants) for the long term, the ability to maintain the required minimum beneficiary threshold and minimum number of primary care providers needed to serve those beneficiaries represents a significant challenge. Primary care physicians are critical to the viability, let alone the success, of the ACO. However, primary care physicians are already in short supply in many areas, with the shortage predicted to increase significantly over the coming years. Moreover, primary care physicians are disadvantaged financially compared to specialists. They are commonly excluded from or otherwise unable to participate in many physician-hospital ventures, and typically are paid much less than most specialists. The ACO model re-emphasizes the importance of primary care physicians as a group and gives them new leverage, as they are the focal point of this industry-wide initiative. 8. PROCESSES TO PROMOTE EVIDENCE-BASED MEDICINE, PATIENT ENGAGEMENT, REPORTING AND COORDINATION OF CARE Section 3022(b)(2)(G) of the ACA requires an ACO to define processes to promote evidence-based medicine and patient engagement, report on quality and cost measures, and coordinate care, such as through the use of telehealth, remote patient monitoring, and other such enabling technologies. CMS is proposing that, in order to be eligible to participate in the MSSP, the ACO provide documentation in its application describing its plans to (a) promote evidence-based medicine, (b) promote beneficiary engagement, (c) report internally on quality and cost metrics, and (d) coordinate care. 16 CMS believes this approach will allow an ACO the flexibility to meet these requirements in a manner that is most appropriate for its particular practitioners and patient populations. At the same time, CMS reserves the right to revise these requirements as essential elements - 7 -

10 for ACO success come to light with ACO experience. CMS is seeking comment on whether more defined criteria are appropriate. a. Processes to Promote Evidence-Based Medicine Evidence-based medicine can be generally defined as the application of the best available evidence gained from the scientific method to clinical decision-making. In practice, CMS believes that such an approach should involve the establishment and implementation, at the organizational or institutional level, of evidence-based guidelines, based on the best available evidence concerning the effectiveness of medical treatments (including the lack of treatment). CMS s proposed evidence-based approach would also involve regularly assessing and updating such guidelines to promote continuous improvement in the quality of care in light of new evidence concerning the effectiveness of medical treatments. ACTION ITEM CMS proposes that, as part of the ACO s application, the ACO describe the evidence-based guidelines it intends to establish, implement and periodically update. b. Processes to Promote Patient Engagement Section 3022 (b)(2)(g) of the ACA also requires an ACO to define processes to achieve patient engagement. According to CMS, the term patient engagement means the active participation of patients and their families in the process of making medical decisions. Patient engagement in decision-making requires not only consideration of the best scientific evidence concerning medical treatment but also the opportunity for patients and families to assess prospective treatment approaches in light of their own values and convictions. Measures for promoting patient engagement may include the use of decision support tools and shared decision-making methods with which the patient can assess the merits of various treatment options in the context of his or her needs, preferences and values. Patient engagement also includes methods for fostering health literacy or basic knowledge about maintaining good health, avoiding preventable medical conditions, managing existing conditions and understanding how the care system works. ACTION ITEM CMS proposes that, as part of the ACO s application, the ACO describe the patient engagement processes it intends to establish, implement and periodically update. c. Processes to Report on Quality and Cost Measures Section 3022 (b)(2)(g) of the ACA requires an ACO to define processes to... report on quality and cost measures. According to CMS, processes that may be used for reporting on quality and cost measures may include, but are not limited to, developing a population health data management capability or implementing practice and physician level data capabilities with point-of-service (POS) reminder systems, to drive improvement in quality and cost outcomes. ACTION ITEM CMS proposes that, as part of its MSSP application, the ACO describe its process to report internally on quality and cost measures, and how it intends to use that process to respond to the needs of its Medicare population and to make modifications in its care delivery. d. Processes to Promote Coordination of Care Section 3022(b)(2)(G) of the ACA requires an ACO to define processes to... coordinate care, such as through the use of telehealth, remote patient monitoring, and other such enabling technologies. Coordination of care involves strategies to promote, improve and assess integration and consistency of care among primary care physicians, specialists, and acute and post-acute providers and suppliers, including methods to manage care throughout an episode of care and during its - 8 -

11 transitions, such as discharge from a hospital or transfer of care from a primary care physician to a specialist. CMS provides a laundry list of proposed strategies that may be used to comply with this standard. These include predictive modeling, utilization of case managers in primary care offices, transition of care programs, remote monitoring, telehealth and focused health information technology allowing for the seamless transition of a beneficiary s records within and outside of the ACO. The provision of any free services (e.g., case managers onsite at a primary care office) could trigger fraud and abuse laws. CMS warns that the strategies employed by an ACO to optimize care coordination should not impede the ability of a beneficiary to seek care from providers that are not participating in the ACO, nor otherwise place restrictions that are not legally required on the exchange of medical records with providers who are not part of the ACO. CMS proposes to prohibit the ACO from developing any policies that would restrict a beneficiary s freedom to seek care from providers and suppliers outside of the ACO. CMS s proposals regarding Processes to Promote Evidence-Based Medicine, Patient Engagement, Reporting, and Coordination of Care make clear that this aspect of ACOs and the related goals are still a work in progress. At this time, CMS is not requiring specific parameters or providing significant guidance with respect to how ACOs propose to implement these aspects and goals of the MSSP. While the lack of guidance gives ACOs flexibility in how they approach these items in their applications, it also leaves ACOs without any assurance that their proposals will meet CMS s standards. In whatever manner an ACO plans to address these aspects of ACO compliance, it will be important for the ACO to coordinate with its participants and other stakeholders, and especially with beneficiaries, in this process. The physicians and health system or hospital participants will be in the best position to monitor advances in evidence-based medicine and incorporate them into the standard ACO protocols. The beneficiaries, physicians, support personnel and others will be essential to ensure beneficiary (and family/caregiver) engagement in the process as well as coordination of care. With respect to coordination of care, CMS s proposals again underscore a disconnect: on the one hand, more resources will be needed; on the other, providing those resources can leave participants exposed to fraud and abuse allegations and related issues. As the ACO concept evolves, it is hoped that more clarity and a more unified government front to address these competing interests in a more global and predictable manner will also develop. In the meantime, ACOs and their participants must realize that participation in the MSSP is not a shield from other federal and state health care laws, and each step taken must be carefully and critically analyzed under current guidance from all perspectives. 9. PATIENT-CENTEREDNESS CRITERIA Section 3022(b)(2)(H) of the ACA requires an ACO to demonstrate that it meets patient-centeredness criteria specified by the Secretary, such as the use of patient and caregiver assessments or the use of individualized care plans. CMS proposes a list of patient-centeredness principles to guide the care provided by a participating ACO, including (a) care being individualized for each patient, (b) beneficiaries having access to their medical records and sufficient clinical knowledge (or evidenced-based medicine) to make informed choices about their care, (c) beneficiaries being encouraged to be partners in care and make choices regarding the care they receive, (d) assessing beneficiary (and caregiver) experience and identifying opportunities for improvement, (e) integrating care with the community resources required to maintain beneficiary well-being, and (f) coordinating transition in care among providers both inside and outside of the ACO. In the Proposed Regulations, CMS sets an aspirational requirement that the ACO should adopt a focus on patient-centeredness that is promoted by the governing body and integrated into practice by leadership and management working with the organization s health care teams. 17 CMS then proposes the following nine specific criteria that each ACO must have to meet the patient-centered requirement: A beneficiary experience survey in place and a description of how the ACO will use the survey results to improve quality over time. CMS is currently proposing to require that every ACO use the Clinician and Group CAHPS survey, including an appropriate functional status module

12 Beneficiary involvement in its governance (as detailed below, this could be met by having the requisite beneficiary member(s) of the ACO s governing board). A process for evaluating the health needs of its assigned population, including consideration of diversity, and a plan to address the needs of its population. Systems to identify and update high-risk individuals, and processes to develop individualized plans for targeted patient populations, including integration of community resources to address individual needs. Such plans must promote improved outcomes for high-risk, multiple-chronic-condition patients and other patient populations, as appropriate. The plans also must be tailored to the beneficiary s needs, preferences and values, and include community resources to support the beneficiary s success with the plan. A mechanism in place for the coordination of care. The ACO must describe this mechanism and should have a process in place (or a clear path to develop such a process) to exchange summary of care information when beneficiaries transfer to other providers (whether within or outside of the ACO). For providers enrolled in the electronic exchange of information, the process must be consistent with meaningful use requirements. A process for communicating clinical knowledge in a way that is understandable to beneficiaries. A process for beneficiary engagement in the decision-making process that is tailored to the needs and preferences of the beneficiary. Written standards for beneficiary access and communication, and a process for beneficiaries to access their medical record. Internal processes for measuring clinical or service performance by physicians across the practices, and for using these results to improve care and service over time. a. Beneficiary Experience of Care Survey CMS proposes that ACOs have a beneficiary experience of care survey and that an ACO s application should describe how the ACO would use the survey results to improve patient care over time. As noted above, CMS proposes that ACOs be required to use the Clinician and Group CAHPS survey, with an appropriate functional survey module, to assess beneficiary experience of care and functional status. Scoring on the patient experience of care survey would become part of the assessment of ACOs quality performance. CMS proposes to require ACOs to collect and report on measures of beneficiaries experience of care, and ACOs will be expected to submit to CMS their plan on how they will promote, assess and continually improve in weak areas identified by the survey. b. Patient Involvement in Governance Another of the proposed patient-centered criteria is the requirement that ACOs provide for patient involvement in their governing processes. To satisfy this criterion, ACOs will be required to have a Medicare beneficiary serviced by the ACO participate in the ACO governing body (CMS specifically discounted subject to commentary being sought the idea of an advisory committee, determining that approach to be inadequate to ensure beneficiary participation.) No beneficiary included in an ACO s governing body, or an immediate family member, may have any conflict of interest (other than, presumably, the conflict that inherently arises from their being a patient or potential patient of the ACO), and they may not be an ACO provider/supplier within the ACO s network. CMS is soliciting comment on whether there should be a minimum standard for such beneficiary participation on ACO governing bodies (e.g., a minimum proportion of control over an ACO s governing body), and whether (a) a Medicare beneficiary advisory panel or committee would be sufficient for appropriate patient participation in ACO governance, and (b) Medicare beneficiary advisory panels or committees also should be required

13 c. Evaluation of Population Health Needs and Consideration of Diversity ACOs must have a process for evaluating the health needs of the population, including consideration of diversity in their patient populations, and a plan to address the needs of their populations. CMS proposes that, in order to satisfy this patient-centered criterion, an ACO be required to describe in the application its process for evaluating the health needs of its Medicare population, including consideration of diversity, and a plan to address the needs of its Medicare population. d. Implementation of Individualized Care Plans and Integration of Community Resources CMS is proposing that ACOs must have systems in place to identify high-risk individuals and processes in order to develop individualized care plans for targeted patient populations. The plan must (a) be tailored to the beneficiary s health and psycho-social needs; (b) account for beneficiary needs, preferences and values; and (c) identify community and other resources to support the beneficiary in following the plan. This plan would be used solely by the patient and ACO providers/suppliers for care coordination. If applicable, and if the beneficiary consents, the care plan should be shared with the caregiver(s), family and others involved in the beneficiary s care. An ACO would be required to have a process in place for developing, updating and, as appropriate, sharing the beneficiary care plan with others involved in the beneficiary s care, and providing it in a format that is usable by the beneficiary. In order to satisfy this requirement fully, individualized care plans should be a result of shared decision-making that fully engages beneficiaries and their families, taking into account their values and preferences in developing a unique plan of care for each individual. The individualized care plans should include identification of community and other resources to support the beneficiary in following the plan. An ACO would be required to submit a description of its individualized care program, along with a sample care plan, and to explain how this program is to be used to promote improved outcomes for, at a minimum, its high-risk and multiple chronic condition patients. In addition, the ACO should describe additional target populations that would benefit from individualized care plans. Under the Proposed Regulations, the ACO would also be required to describe how it would partner with community stakeholders as part of its application. ACOs that have a stakeholder organization serving on their governing body would be deemed to have satisfied this requirement. The proposal to utilize the CAHPS survey as the exclusive option for a survey tool to assess beneficiary experience is a nod to uniformity and simplicity, but would exclude other good tools. Additionally, providers that currently utilize other tools may feel that their historic data collection may not match up well with the information obtained through CAHPS, thus costing them part of the benefit of their past efforts. Additionally, while the patient centeredness requirements are set forth in the Proposed Regulations, there is not a lot of meat on the bones for each requirement. While there is a clear path to complying with some (e.g., having a beneficiary on the governing board of the ACO), others offer little guidance regarding what is required for the ACO to comply. CMS will likely continue to develop these requirements over time. In the meantime, it is clear that CMS wants to ensure that ACOs are focused on their beneficiaries needs, including planning for high-risk patients and the diversity of patient populations, as well as making beneficiaries active and knowledgeable participants in their care. Successful ACOs will do well to go beyond the minimum requirements of beneficiary participation and coordination of care, and make it a core principle to ensure the accountable care being provided is the result of the collective efforts of the ACO participants, beneficiaries, their families and other stakeholders. 10. ACO MARKETING GUIDELINES Consistent with its patient-centered focus, CMS highlights its concern that beneficiaries may be misled about the benefits of and services available from an ACO. To protect against these concerns, CMS proposes to require that all ACO marketing materials, communications and activities related to the ACO and its participation in the MSSP (and any changes to these materials) be subject to CMS approval, similar to those requirements that govern marketing materials under Medicare Advantage and Medicare Part D. For purposes of this section, CMS defines marketing materials to include general audience materials such as brochures, advertisements, outreach events, letters to beneficiaries, web pages, mailings or other activities. CMS includes any such materials or marketing activities used by ACO participants or ACO providers/suppliers on behalf of the ACO. Informational materials, non-aco related pieces, referrals, billing/claims communications and medical-condition-related mailings (e.g., regarding flu shots) are not marketing materials subject to approval by CMS. ACOs that fail to adhere to CMS s marketing guidelines may be placed under a corrective action plan, or may be subject to termination from the MSSP, at CMS s discretion

14 MCDERMOTT COMMENTARY Organizations that have not been previously required to submit marketing materials to CMS for approval will face a significant learning curve in order to comply with these ACO marketing guidelines. If the Medicare Advantage and Medicare Part D marketing guidelines are any indication, the marketing guidelines governing ACOs will contain some very specific requirements, such as the precise permissible font sizes, footnote placement and required disclosures. ACOs will need to build in lead time for the development of these materials to allow for CMS s approval, and also be prepared to make revisions if necessary. 11. PROGRAM INTEGRITY REQUIREMENTS Some of the more glossed-over provisions set forth in the Proposed Regulations are the provisions designed to protect the MSSP from fraud and abuse. However, organizations contemplating establishing an ACO should be mindful of these requirements, given CMS s increased enforcement in this area. First, CMS proposes to require that ACOs adopt a compliance plan that includes at least the following five elements: A designated compliance official or individual who is not legal counsel to the ACO and who reports directly to the ACO s governing body Mechanisms for identifying and addressing compliance problems related to the ACO s operations and performance A method for employees or contractors of the ACO or ACO providers/suppliers to report suspected problems related to the ACO Compliance training of the ACO s employees and contractors A requirement to report suspected violations of law to an appropriate law enforcement agency There is no need to duplicate efforts to the extent the applicant organization already has a compliance program in place that satisfies these requirements (e.g., a hospital-owned ACO applicant s compliance officer and program should suffice), so long as the ACO can demonstrate that its compliance mechanisms are effective. Second, CMS emphasizes that ACOs maintain ultimate responsibility for compliance with all terms and conditions of their agreement. To ensure that all entities that participate in an ACO remain committed to complying with the MSSP requirements, CMS proposes to require that all contracts between an ACO, its ACO participants, and ACO providers and suppliers, or other entities furnishing services related to ACO activities, mandate that the contracting entities comply with the ACO program requirements. Further, CMS will require an authorized representative of the ACO, with authority to legally bind the ACO, to certify the accuracy, completeness and truthfulness of the information contained in the (a) MSSP application, (b) agreement with CMS, and (c) quality and other data submitted to CMS. Similarly, each written request for a shared savings payment must include a certification from an authorized representative of the ACO that the ACO is in compliance with program requirements, as well as to the accuracy, completeness and truthfulness of any information submitted directly or indirectly by the ACO. Third, CMS proposes to require that ACOs have a conflicts of interest policy in place that applies to members of the ACO s governing body and that requires members to disclose relevant financial interests, so that the ACO may determine whether a conflict exists. The policy must also include remedial actions for members of the governing body who fail to comply with this requirement. However, CMS does not define what is meant by a relevant financial interest, which could lead to a number of uncertainties when evaluating whether a conflict, perceived or real, would prevent an entity from participating in an ACO. Fourth, because ACOs will not be subject to CMS existing provider enrollment screening, CMS is considering conducting individual screens on the ACO application process with regard to the program integrity history of participants, including the history of any program exclusions or other sanctions, as well as any affiliations with individuals or entities that have a history of program integrity issues

15 Finally, CMS proposes to prohibit ACOs from conditioning participation in the ACO on referrals of federal health care program business that the ACO or ACO participants know or should know is being provided to beneficiaries who are not assigned to the ACO. CMS is particularly concerned about the risks of abuse if it ends up assigning beneficiaries to an ACO on a prospective basis at the beginning of a performance period. B. The Start Date for the ACO Agreement Section 3022 of the ACA provides that an ACO is to enter into an agreement to participate in the MSSP for no fewer than three years. To implement this provision, the Proposed Regulations address the start date for the three-year agreements and the associated application evaluation period. In considering various start date options (annual, semi-annual, rolling and delayed), CMS focused on striking an appropriate balance between affording flexibility to program applicants and achieving streamlined administration of the application process. The Proposed Regulations adopt an annual, calendar-year approach to both the start date and the application evaluation period, under which (a) CMS would establish a deadline for submission of ACO applications, (b) CMS would review applications prior to the end of the calendar year in which they were received, (c) the three-year period under each agreement would begin on the January 1 following approval of the application, and (d) each performance period would begin on January 1 of each year under the three-year agreement. CMS chose this approach in large part because of the January 1, 2012, deadline for establishment of the MSSP and the difficulties other approaches presented for the assignment of beneficiaries to an ACO. However, CMS also invites comment on other approaches to the January 1 start date that would allow the greatest number of participants to apply for participation in the first year (2012) of the MSSP. 18 The Proposed Regulations are silent with regard to whether CMS will develop a standard MSSP application. It now appears unlikely that CMS will hold hard and fast to the January 1, 2012, start date for the initial MSSP agreement, particularly in light of the recent reports that the nature and extent of the comments and criticism CMS has received to date will likely delay publication of the final MSSP regulations. 1. EFFECT OF CHANGES THAT OCCUR DURING AN ACO AGREEMENT S THREE-YEAR PERIOD The Proposed Regulations address the potential effect of two types of changes that could occur during the current three-year term of an ACO agreement: (a) program changes made by CMS, and (b) other changes that can cause the ACO to deviate from the basis for eligibility presented in its application. a. Program Changes by CMS In attempting to balance the risk that CMS-initiated changes will affect an ACO s continued eligibility with the benefits of achieving consistency and ease of administration of eligibility requirements, CMS proposes that ACOs be subject to all future program changes by CMS except those affecting (a) eligibility requirements concerning an ACO s structure and governance, (b) calculation of the shared savings rate, and (c) assignment of beneficiaries. Therefore, during the term of its agreement with CMS, an ACO would need to be prepared to accept and adapt to regulatory changes in areas such as quality measures and quality management, program integrity requirements, patient engagement processes and patient-centeredness criteria that may necessitate changes in how the ACO designs and delivers care. In the event that such changes are implemented by CMS, an ACO would be required to provide CMS with a supplement to the ACO s original application explaining how the ACO will address such changes; failure to do so could trigger the need to file a corrective action plan or could lead to termination of the agreement, or eventually both

16 b. Other Changes CMS describes several types of changes other than those made by CMS that could affect an ACO s current MSSP agreement, including changes in governance structure or leadership; provider composition; beneficiary population; key processes pertaining to the design, delivery and quality of care (e.g., processes for quality management and patient engagement and patient-centeredness criteria); and planned distribution of savings. CMS expresses particular concern over changes in provider composition that could require additional antitrust review or re-review. Specifically, the Proposed Regulations prohibit an ACO from adding participants during the three-year period covered by its agreement, but permit the ACO to remove participants or to add or remove non-participant provider/suppliers. The ACO must notify CMS of any significant changes within 30 days, and CMS will then conduct a review. The possible outcomes of CMS s review include the termination of the agreement and forfeiture of savings earned, the ACO being subjected to a new antitrust review, the application of a new threeyear agreement, and the recalculation of the ACO s savings based on the updated list of participants and providers/suppliers. CMS and the ACO may also mutually agree to terminate the ACO agreement. What if there are compelling and appropriate reasons for an ACO to add a participant, such as the loss of key primary care physicians? It is difficult to understand why CMS did not allow the addition of a participant with prior CMS approval, but perhaps in practice this could be accomplished through a waiver. CMS proposes that ACOs that experience a loss in their first three-year agreement and ACOs that were terminated for program integrity failures (e.g., avoidance of at-risk beneficiaries) be barred from future participation in the MSSP. Voluntary or forced termination of an agreement for other reasons would not necessarily bar future participation. However, all applications for three-year agreements must disclose information to enable CMS to determine whether the applicant previously participated in the ACO program, the basis for termination of a prior agreement, and the safeguards the ACO has established to enable participation for the full three-year period under the new agreement. Further, a new three-year agreement may not begin until the three-year period under the prior agreement has lapsed. 2. TIMING AND PROCESS FOR EVALUATING SHARED SAVINGS PERFORMANCE Section 3022 of the ACA also provides that an ACO shall be eligible to receive shared savings payments for each year of the agreement s three-year period if it meets the quality performance standards established under the ACA and achieves the required percentage of savings benchmark. In considering the timing for evaluating shared savings eligibility, CMS focused on striking the appropriate balance between providing timely performance feedback and achieving accuracy in the claims data used to calculate the per capita shared savings achieved. It proposed the use of a six-month claims-run-out period 19 to calculate the performance benchmark and per capita expenditures for the performance year, concluding that the associated delay in computing shared savings payments is warranted by the increased accuracy of the underlying data used. CMS requests comments concerning additional considerations that would make the use of a three-month claims-run-out period more appropriate. 3. DATA SHARING a. Scope of the Proposed Regulations The Proposed Regulations recognize that access to appropriate data will be essential for an ACO to comply with the quality measurement and reporting requirements of Section 1899(b)(2)(A) of the ACA, but the ACA is silent regarding whether and to what extent CMS may or should provide ACOs with CMS data to assist them in meeting these requirements. 20 CMS states that ACOs eventually will be expected to self-manage independently their assigned beneficiary populations by identifying and producing the data they believe necessary to (a) monitor and evaluate the performance of their participants and providers/suppliers relative to quality and patient experience benchmarks, (b) produce efficiencies in the utilization of services, (c) conduct quality improvement activities, (d) evaluate the health needs of the populations they serve, (d) conduct population-based activities to improve the health of their populations and (e) improve health outcomes. Recognizing that many ACOs will be unable to meet that burden at the outset, the Proposed Regulations call for CMS to provide ACOs with three categories of information, including two types of beneficiary-identifiable data and aggregated data reports that will contain none of the HIPAA identifiers. 21 CMS notes that combining the CMS-provided data with provider level and other data internally

17 generated and compiled within the ACO will enable an ACO to develop a more complete picture of the care that its beneficiary population receives within and outside the ACO of its participants and providers patterns of care, as well as to compare the ACO s current year performance with that of the previous year. The Proposed Regulations describe the types of data CMS would share, articulate the rationale for proposing to make the CMS data available, and summarize the analysis underlying CMS s determination that sharing the data with ACOs is legally permissible under the ACA, HIPAA and other applicable federal privacy laws. The Proposed Regulations also adopt a belt and suspenders approach to managing the privacy risks, by imposing certain additional privacy protections that go beyond what federal privacy laws would require. Notably, the Proposed Regulations data-sharing provisions focus on the sharing of data by CMS with ACOs, not datasharing within an ACO and among its participants and providers/suppliers, and, therefore they do not identify or analyze federal or state law restrictions that would limit such internal data-sharing. b. Types of Data Sharing and Underlying CMS Rationale I. FOUR SPECIFIC BENEFICIARY-IDENTIFIABLE DATA ELEMENTS If requested by an ACO, CMS would provide the ACO with four data elements at the beginning of the first performance year of its agreement name, date of birth, sex and Health Insurance Claim Number (HICN) for beneficiaries who historically received the plurality of primary care services from the ACO s primary care physician participants. Having these data elements will enable the ACO to identify the beneficiaries CMS used to generate the aggregate reports (described below) and to determine the ACO s benchmark. CMS recognized certain risks inherent in disclosing beneficiary-identifiable data on a historical basis, 22 but concluded that the risks are outweighed by the potential benefits of knowing this information, such as the ability to identify needed improvements in care processes and coordination strategies (e.g., assuring timely access to office-based or clinicbased care to avoid unnecessary emergency room visits, improved care coordination strategies). 23 The Proposed Regulations also include certain other provisions to protect against that risk and allow CMS to achieve the intended benefits. Beneficiaries would not be given the right to opt out of having CMS share these data elements with their ACOs. II. BENEFICIARY-IDENTIFIABLE CLAIMS DATA ACOs would be able to request identifiable CMS claims data on a monthly basis for the beneficiaries who have received services from the ACO participants and providers/suppliers during the performance year. Subject to certain limitations described below, CMS would provide the data in the form of a standardized data set that includes the minimum necessary 24 data to assist the ACO in evaluating the performance of its participants and providers/suppliers, conducting quality assessment and improvement activities, and conducting population-based activities relating to improving the health of the ACO beneficiary population. An ACO may choose to make its request for the claims data either as part of the application process or during its three-year agreement period. In either case, the ACO must submit a formal request that explains how it intends to use the data in evaluating the performance of its participants and providers/suppliers. The ACO must also attest that it is either a HIPAA-covered entity or a business associate of the ACO s participants and providers/suppliers (which themselves are HIPAA-covered entities), that the ACO is requesting only the minimum data necessary for those permitted MSSP purposes and that the ACO will limit its use of the data to the MSSP permitted purposes. As a business associate, the ACO must further attest that its business associate agreements authorize it to request the claims information for the permitted purposes described above; as a covered entity, the ACO must further attest that it is requesting the claims data only for its own patients

18 MCDERMOTT COMMENTARY An ACO and its providers and suppliers may find it helpful to have historical beneficiary-identifiable data and aggregated data reports prior to and during the application process to analyze and assess the financial feasibility of participation in the MSSP and to begin to develop the ACO s quality, care coordination, patient experience and cost efficiency strategies. However, the Proposed Regulations call for CMS to share such data only during the three-year agreement period. The Proposed Regulations impose certain limitations and conditions on the sharing of the CMS beneficiary-identifiable claims data that go beyond what HIPAA would require, 25 and expressly recognize specific disclosure prohibitions and restrictions imposed under applicable federal law. First, as part of the overall ACO communication plan envisioned by the Proposed Regulations, the ACO must provide beneficiaries with a standardized written notice, at the time they seek services from one of the ACO s primary care physicians, of their participation in the MSSP and the potential for CMS to share their identifiable data with the ACO. The ACO must also provide beneficiaries with notice of their opportunity to opt out of having their CMS claims data shared with the ACO and with a form to use in exercising the opt out. 26 The ACO may not request data on beneficiaries who have exercised their opt out right. CMS will maintain a list of HICNs that have elected to opt out. Second, the ACO must enter into a Data Use Agreement (DUA) prior to receiving any data, under which the ACO would agree to comply with the limitations and requirements of HIPAA and other applicable privacy and confidentiality requirements, as well as to use and disclose the data only in the manner that a HIPAA-covered entity may use and disclose it, and not for any prohibited purpose. 27 The DUA would also expressly provide that failure to comply with the DUA would render the ACO ineligible to continue to receive the data and could lead to imposition of sanctions and penalties available under applicable law as well termination of its agreement. Third, absent express consent from the beneficiary, CMS will not share claims data from records maintained in connection with federally conducted or assisted substance abuse programs that reveals a beneficiary s identity, diagnosis, prognosis or treatment. 28 The Proposed Regulations state that [t]he decision to opt-out in no way effects use of the beneficiaries data or assignment to the ACO for purposes of determining such calculations as ACO benchmarks, per capita costs, quality performance or performance year per capita expenditures. Arguably, these provisions are intended to allow CMS to continue to use the identifiable data to conduct analysis, provide aggregated data reports, and set performance benchmarks and standards. Nonetheless, the statement is vague and needs clarification concerning the scope of permitted disclosure and use of claims data regarding beneficiaries who have elected to opt out. A further condition on an ACO s right to request and receive the data from CMS is that the ACO does not [impose] unnecessary limitation or restrictions on the use or disclosure of individually identifiable health information that it internally compiles from providers and suppliers both within and outside of the ACO. On its face, this condition is vague, and CMS provides no discussion or explanation of its intent and scope. CMS acknowledges the importance of providing beneficiary-identifiable claims data that is both current and timely for an ACO to be able to establish baselines of utilization and patient morbidity, identify key beneficiaries and subpopulations for proactive care coordination efforts, and track its progress against defined performance measures. 29 Therefore, CMS proposes to provide the claims data on a monthly basis during the current performance year, instead of providing prior year historical data. CMS notes, however, that this claims data will not provide the basis for either (a) real time responses to the ACO s providers during a beneficiary s hospital stay (because of the claims lag between the time of discharge and the hospital s submission of the claim to CMS) or (b) a full analysis of the beneficiary population that the ACO cared for during the

19 performance year (because the ACO s beneficiaries are free to choose to obtain services from providers outside the ACO). Accordingly, CMS encourages ACOs to pursue access to more timely and complete beneficiary-identifiable claims data through other means and sources, such as through the implementation of interoperable health records, participation in health information exchanges, and more effective coordination with admission and discharge personnel in hospitals utilized by the ACO s patients. These other data strategies will also position the ACO to identify and produce the data that it will need to self-manage its assigned beneficiary populations, a capability that CMS will come to expect of the ACO. III. AGGREGATED DATA REPORTS CMS would provide aggregated data reports containing metrics on the assigned beneficiary population and beneficiary utilization data at the start of the agreement and quarterly aggregated data reports thereafter based on the most recent 12 months of assigned beneficiary data. The data will not include beneficiary-identifying information. 30 Instead, CMS will include de-identified claims history of the services rendered for the ACO s beneficiaries. This data would be intended to help ACOs to achieve the primary goals of improving the quality of care, improving the health of their assigned populations and creating efficiencies. Possible uses identified in the Proposed Regulations include (a) monitoring, understanding and managing an ACO s utilization and expenditure patterns, and (b) developing, targeting and implementing quality improvement programs and initiatives. The Proposed Regulations do not describe in detail the nature and content of the reports that CMS would provide to an ACO or indicate whether they will be similar to those provided under the PGP Demonstration. The Proposed Regulations simply state that the reports will include information on financial performance, quality performance scores, aggregated beneficiary population metrics and beneficiary utilization data. Insights on what it is likely to include can be drawn from the somewhat detailed description of the annual profile report it provided to participating group practices in the PGP Demonstration, which also included information on financial performance, 31 quality performance, 32 aggregated beneficiary population metrics 33 and certain beneficiary encounter data LEGAL AUTHORITY FOR CMS SHARING OF BENEFICIARY-IDENTIFIABLE DATA Section 1106 of the Social Security Act generally bars the disclosure of information collected under the Affordable Care Act without beneficiary consent, unless otherwise permitted by applicable statutes and regulations. The Proposed Regulations rely primarily on the HIPAA Privacy Rule 35 as support for the permissibility of sharing with ACOs the four beneficiary-identifiable data elements and the beneficiary-identifiable CMS claims data. The Proposed Regulations also recognize and discuss the provisions of (a) federal law governing disclosure of information from records created in connection with federally conducted or assisted substance abuse programs; 36 (b) the Federal Privacy Act that generally prohibits disclosure of information from a system of records by agencies such as CMS to any third party without the prior written consent of the individual to whom the records apply; 37 and (c) the special rule issued in May 2008 authorizing the Secretary to collect Part D claims data originally collected for Part D payment purposes for use in research, analysis, reporting and public health functions. 38 In short, the Proposed Regulations conclude that the proposed data-sharing under all these federal statutes, regulations and rules is permissible, and therefore that an ACO may request CMS to share the data for beneficiaries that have not chosen to opt-out, so long as the ACO has complied with the DUA, attestation and other requirements specifically imposed under the Proposed Regulations. a. HIPAA Compliance The MSSP is part of the Medicare FFS Program, which is a health plan and a covered entity subject to HIPAA. The ACO s participants and providers/suppliers are also HIPAA-covered entities. The ACO would be a covered entity if it is a provider of health care services and engages in HIPAA-covered electronic transactions. In other cases, the ACO will function as a business associate of the ACO participants and be permitted under HIPAA to receive and use identifiable information to carry out health care operations on their behalf. The ACO will use the beneficiary-identifiable information in activities that qualify as its own health care operations (if a provider) and the health care operations of its participants under the first and second paragraphs of the HIPAA definition of health care operations. 39 Finally, CMS and the ACO (if a provider),

20 and CMS and each of the ACO s participants, have had a relationship 40 with the beneficiaries whose identifiable claims information is being shared, and the disclosure of the data by CMS pertains to that relationship. 41 Accordingly, HIPAA permits an ACO to request CMS to disclose identifiable plan beneficiary data to the ACO and its participants, without obtaining an express authorization from the beneficiaries or qualifying for a waiver or exception to the HIPAA authorization requirement, so long as the information provided is only the minimum data necessary to accomplish the MSSP goals of the ACO. 42 b. Compliance with Federal Substance Abuse Program Records Laws The Proposed Regulations take a broad-brush, conservative approach to compliance with federal laws applicable to disclosure of substance abuse program records. That is, CMS simply would not share claims data from records maintained in connection with federally conducted or assisted substance abuse programs that reveals a beneficiary s identity, diagnosis, prognosis or treatment absent an express authorization by the beneficiary. 43 c. Privacy Act Compliance CMS concludes that the proposed sharing of beneficiary-identifiable data with ACOs is permitted under the Federal Privacy Act as a routine use, because it would constitute disclosure to someone outside the agency that is compatible with the purpose for which CMS collected the data. d. Part D Data Rule The Proposed Regulations appear to conclude that the sharing of Part D data with an ACO is permissible under the final rule governing the re-collection and secondary use of Part D claims information, based on the following two statements made in the Proposed Regulations: (a) the intent of the rule is to allow use of the Part D data for a wide variety of purposes, including supporting care coordination and disease management programs and supporting quality improvement performance measurement activities, 44 and (b) it is in the interest of public health to share the information collected... with entities outside of CMS for legitimate research ACTION ITEM Development and implementation of an electronic health data strategy and supporting technology infrastructure are immediate and critical steps for any accountable care strategy whether it involves participation in the MSSP as of January 12, 2012, or any time thereafter, other innovative payment models under ACA (e.g., bundled payments), or payfor-performance and other payment innovations in the private sector. Accordingly, all stakeholders must move swiftly and deliberately to establish an electronic data strategy and supporting infrastructure. In doing so, it is important to recognize that there is no one size fits all or risk-free approach. Evaluate the capacity and capability of the current health information infrastructure to support robust quality measurement, analytics and reporting, care coordination and alignment of incentives under new payment and reimbursement models. Accelerate electronic health record (EHR) system implementation and integration in both the inpatient and ambulatory care settings. Take advantage of current flexibility under federal fraud and abuse laws to donate EHR technology to physicians; financial incentives available under the 2009 HITECH Act for meaningful use of certified EHR technology; and emerging health information exchange initiatives at community, regional and state-wide levels. Address the build vs. buy decisions early in the planning process, by taking the following actions, among others: Exploring opportunities to supplement internal electronic data capabilities and infrastructure, at least for the short term, with outsourced and subscription-based capabilities such as third-party registry and quality/performance analytics and the rapidly evolving cloud computing service model paradigm Anticipating and exploring opportunities to collaborate with other hospitals and health systems, state governments, universities and others to leverage human and capital resources and to reduce the learning curve